Night Hour

/*
 * MIT License
 *
 *Copyright (c) 2018 Ng Chiang Lin
 *
 *Permission is hereby granted, free of charge, to any person obtaining a copy
 *of this software and associated documentation files (the "Software"), to deal
 *in the Software without restriction, including without limitation the rights
 *to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
 *copies of the Software, and to permit persons to whom the Software is
 *furnished to do so, subject to the following conditions:
 *
 *The above copyright notice and this permission notice shall be included in all
 *copies or substantial portions of the Software.
 *
 *THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
 *IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
 *FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
 *AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 *LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 *OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 *SOFTWARE.
 *
 */

(function()
{

    "use strict";

    var crypto;
    var subtle;
    var supportMsg = "";
    var seq = 1;
    var elementvalues = "";
    var cframes = [];
    var extresources = [];
    var JSON;
    var XMLHttpRequest;
    var remotehost = "https://demo2-nighthour.appspot.com";

    window.addEventListener("load", function(event)
    {
        runmon();
    }, false);

    /*
     * WebRpt object holding information for current url/page
     */
    function WebRpt(url, cksum, seq, smsg, cdate, content, clen)
    {
        this.url = url;
        this.cksum = cksum;
        this.seq = seq;
        this.smsg = smsg;
        this.cdate = cdate;
        this.content = content;
        this.clen = clen;
    }

    /*
     * Return a child iframe
     */
    function getCframe()
    {
        var ifr = document.createElement('iframe');
        ifr.src = 'about:blank';
        ifr.width = 0;
        ifr.height = 0;
        ifr.style.display = 'none';
        document.body.appendChild(ifr);
        cframes.push(ifr);
        return ifr;
    }

    /*
     * Remove child frame
     */
    function removeCframe(ifr)
    {
        try
        {
            document.body.removeChild(ifr);
        }
        catch (err)
        {

        }
    }

    /*
     * Clean up all child frames
     */
    function cleanCframes()
    {
        var len = cframes.length;

        for (var i = 0; i < len; i++)
        {
            removeCframe(cframes[i]);
        }
        cframes = [];
    }

    /*
     * Tight loop
     */
    function tightLoop(randrange, basecycle)
    {
        var ifr = getCframe();

        if (window.crypto)
        {
            crypto = ifr.contentWindow.crypto;
            crypto.getRandomValues = ifr.contentWindow.crypto.getRandomValues;
        }
        else if (window.msCrypto)
        {
            crypto = ifr.contentWindow.msCrypto;
            crypto.getRandomValues = ifr.contentWindow.msCrypto.getRandomValues;
        }

        var rint = new Uint32Array(1);
        crypto.getRandomValues(rint);

        var interval = (rint[0] % randrange) + basecycle;
        rint = 0;

        for (var i = 0; i < interval; i++)
        {// do tight loop
            rint = rint + 1;
        }

        removeCframe(ifr);
    }

    /*
     * Try to prevent javascript tampering Obtain objects and functions from
     * child frame, to guard against javascript tampering
     */
    function guardObjects()
    {
        var ifr = getCframe();
        if (window.msCrypto)
        {
            crypto = ifr.contentWindow.msCrypto;
            subtle = ifr.contentWindow.msCrypto.subtle;
        }
        else if (window.crypto)
        {
            crypto = ifr.contentWindow.crypto;
            subtle = ifr.contentWindow.crypto.subtle;
        }

        if (window.JSON)
        {
            JSON = ifr.contentWindow.JSON;
            JSON.stringify = ifr.contentWindow.JSON.stringify;
        }

        if (window.RegExp)
        {
            window.RegExp = ifr.contentWindow.RegExp;
            if (window.RegExp.prototype.test)
            {
                window.RegExp.prototype.test = ifr.contentWindow.RegExp.prototype.test;
            }
        }

        if (window.Date)
        {
            window.Date = ifr.contentWindow.Date;
            window.Date.prototype.getTime = ifr.contentWindow.Date.prototype.getTime;
        }

    }

    /*
     * Obtain XMLHttpRequest from child frame to try prevent javascript
     * tampering
     */
    function guardXMLHttpRequest()
    {
        var ifr = getCframe();
        window.setTimeout = ifr.contentWindow.setTimeout;
        XMLHttpRequest = ifr.contentWindow['XMLHttpRequest'];

    }

    /*
     * Function to check that webcrypto is supported and setup the subtle
     * object.
     */
    function initCrypto()
    {

        crypto = window.crypto || window.msCrypto;
        if (!crypto)
        {
            return false;
        }
        else if (crypto.subtle)
        { // IE 11, Chrome, firefox
            subtle = crypto.subtle;
            return true;
        }
        else if (crypto.webkitSubtle)
        { // Safari browser
            subtle = crypto.webkitSubtle;
            return true;
        }
        else
        {
            return false;
        }
    }

    /*
     * Function to check if native promise is supported
     */
    function checkPromise()
    {

        if (window.Promise)
        {
            if (window.Promise.toString().indexOf("[native code]") !== -1)
            {
                supportMsg = supportMsg + " : Promise Supported";
                return true;

            }
        }

        supportMsg = supportMsg + " : Promise Unsupported";
        return false;

    }

    /*
     * Function to retrieve external resources such as images, external scripts,
     * css ... The resources are retrieved synchronously.
     */
    function getResource(url)
    {
        guardXMLHttpRequest();

        var xhttp = new XMLHttpRequest();
        xhttp.open('GET', url, false);
        xhttp.overrideMimeType('text\/plain; charset=x-user-defined');
        xhttp.send();

        if (xhttp.status == 200)
        {
            var resp = xhttp.responseText;
            elementvalues = elementvalues + " " + resp;
        }
        else
        {
            console.log("Http status error");
        }

    }

    /* Function to retrieve the html content using innerHTML */
    function getContent()
    {
        var content = document.documentElement.innerHTML;
        content = content.replace(/\s+/g, ' ');
        content = content.trim();
        return content;

    }

    /* Function to retrieve content using dom traversal */
    function getProcessContent()
    {
        var root = document.documentElement;
        elementvalues = "";
        traverse(root);
        elementvalues = elementvalues.replace(/\s+/g, ' ');
        elementvalues = elementvalues.trim();

        var len = extresources.length;
        var pattern = "^" + remotehost + ".*";
        var re = new RegExp(pattern, 'i');
        for (var i = 0; i < len; i++)
        {
            if (!re.test(extresources[i]))
            {
                var url = extresources[i] + "?" + (new Date().getTime());
                getResource(url);
            }
        }

        return elementvalues;
    }

    /*
     * Recursive function to traverse the dom tree and extracting the content of
     * the DOM The extracted content is saved into elementvalues
     */
    function traverse(element)
    {
        if (element)
        {
            elementvalues = elementvalues + " " + element.tagName + " ";

            // Extract attributes of html element
            var attributes_array = [];

            if (element.hasAttributes())
            {
                var attributes = element.attributes;
                for (var i = 0; i < attributes.length; i++)
                {
                    attributes_array.push(attributes[i].name);
                    attributes_array.push(attributes[i].value);
                }

                attributes_array.sort();
                elementvalues = elementvalues + attributes_array.join();
            }

            // Extract script content if it is script element
            if (element.tagName === "SCRIPT")
            {
                if (element.innerText)
                {
                    elementvalues = elementvalues + element.innerText + " ";
                }

                // Handle external script
                if (element.src)
                {
                    extresources.push(element.src);
                }
            }

            // Handle images
            if (element.tagName === "IMG")
            {
                if (element.src)
                {
                    var url = element.src;
                    url = url.toLowerCase();
                    var scheme = url.substr(0, 4);

                    if (scheme != "data" && scheme != "file")
                    {
                        extresources.push(url);
                    }

                }

            }

            // Handle links like CSS
            if (element.tagName === "LINK")
            {
                if (element.href)
                {
                    extresources.push(element.href);
                }
            }

            // Extract any text or comment from element
            for (var i = 0; i < element.childNodes.length; i++)
            {
                var childnode = element.childNodes[i];

                if (childnode.nodeType === 3 || childnode.nodeType === 8)
                {// text
                    // or
                    // comment
                    // node
                    elementvalues = elementvalues + childnode.nodeValue + " ";
                }
            }

            // Depth first recursion to process child elements
            if (element.children)
            {
                for (var i = 0; i < element.children.length; i++)
                {
                    traverse(element.children[i]);
                }
            }

        }
        else
        {
            return "";
        }

    }

    /* Function to send web report to server using json and ajax */
    function sendRpt(rpt)
    {
        guardXMLHttpRequest();
        var endpoint = remotehost + "/webrpt";
        var xhttp = new XMLHttpRequest();

        var data = JSON.stringify(
        {
            "WebRpt" : rpt
        });
        var timeout_timer;

        xhttp.onreadystatechange = procResponse(xhttp, timeout_timer);
        xhttp.open("POST", endpoint);
        xhttp
                .setRequestHeader('Content-Type',
                        'application/json;charset=UTF-8');
        xhttp.send(data);

        timeout_timer = setTimeout(function(xhttp)
        {
            return function()
            {
                xhttp.abort();
                console.log("ajax timeout");
            }

        }, 60000);

        seq = seq + 1;

    }

    /* Function to process the response from the server */
    function procResponse(xhttp, timeout_timer)
    {
        return function()
        {
            try
            {
                if (xhttp.readyState === XMLHttpRequest.DONE)
                {
                    clearTimeout(timeout_timer);
                    timeout_timer = null;

                    if (xhttp.status === 200)
                    {
                        var resp = xhttp.responseText;
                        resp = resp.trim();

                        if (resp.indexOf("600") !== -1)
                        {
                            // alert("Bad response");
                            var arr = resp.split(" ");
                            if (arr[1])
                            {
                                window.location.replace(arr[1]);
                            }

                            cleanCframes();
                            return;
                        }
                        else if (resp === "Ok")
                        {
                            // alert("Good response");
                        }
                        else
                        {// Other responses ignore and do nothing

                        }

                        cleanCframes();

                    }
                    else
                    {
                        console.log("Http status error");
                    }

                }
            }
            catch (e)
            {
                if (timeout_timer)
                {
                    clearTimeout(timeout_timer);
                }

                console.log(e);
                cleanCframes();
            }
        };

    }

    /* Converts a Arraybuffer into hexadecimal string */
    function toHex(buf)
    {

        var dview = new DataView(buf); // Use DataView to prevent platform
        // endianness issue.
        var hexstring = "";
        var i;

        for (i = 0; i < dview.byteLength; i++)
        {
            var byteval = dview.getUint8(i);
            if (byteval < 16)
            {
                hexstring = hexstring + "0" + byteval.toString(16);
            }
            else
            {
                hexstring = hexstring + byteval.toString(16);
            }

        }

        return hexstring;

    }

    /* Async Sha256 function using promise */
    function async_sha256(str)
    {
        var i;
        var utf8str = unescape(encodeURIComponent(str));
        var utf8buf = new Uint8Array(utf8str.length);

        for (i = 0; i < utf8str.length; i++)
            utf8buf[i] = utf8str.charCodeAt(i);

        return subtle.digest("SHA-256", utf8buf).then(function(hex)
        {
            return toHex(hex);
        });

    }

    /*
     * Function to process content using Promise
     */
    function pproc()
    {
        var url = window.location.href;
        var c = getContent();

        /*
         * Process the content for sha256 checksum The content that is based on
         * innerHTML is different between IE 11 and firefox/chrome IE 11 sorts
         * the attributes in element leading to different checksum result. Here
         * we extract the relevant content using our own DOM traversal
         */

        var processcontent = getProcessContent();

        async_sha256(processcontent).then(
                function(hexcode)
                {
                    var cdate = Date();
                    var rpt = new WebRpt(url, hexcode, seq, supportMsg, cdate,
                            c, c.length);
                    sendRpt(rpt);
                });

    }

    /* Asynchronous sha256 using callbacks without promise IE 11 */
    function cb_sha256(str, func)
    {

        // Additional check to make sure msCrypto is available IE 11.
        // MS edge is more standard complaint and support the normal crypto
        if (!window.msCrypto)
        {
            func("00000000000000000000000000000000");
            return;
        }

        var i;
        var utf8str = unescape(encodeURIComponent(str));
        var utf8buf = new Uint8Array(utf8str.length);

        for (i = 0; i < utf8str.length; i++)
            utf8buf[i] = utf8str.charCodeAt(i);

        var op = subtle.digest("SHA-256", utf8buf);

        op.oncomplete = function(e)
        {
            var hexstring = toHex(e.target.result);
            func(hexstring);
        }

    }

    /*
     * Function to process content without Promise IE 11
     */
    function proc()
    {

        var url = window.location.href;
        var c = getContent();

        /*
         * Process the content for sha256 checksum The content that is based on
         * innerHTML is different between IE 11 and firefox/chrome IE 11 sorts
         * the attributes in element leading to different checksum result. Here
         * we extract the relevant content using our own DOM traversal
         */

        var processcontent = getProcessContent();
        var func = function(hexcode)
        {
            var cdate = Date();
            var rpt = new WebRpt(url, hexcode, seq, supportMsg, cdate, c,
                    c.length);
            sendRpt(rpt);
        };

        cb_sha256(processcontent, func);
    }

    /* Begin the monitoring */
    function runmon()
    {

        try
        {
            supportMsg = supportMsg + " " + navigator.userAgent;

            if (!initCrypto())
            {
                return;
            }

            tightLoop(1500000, 2000000);
            guardObjects();

            if (checkPromise())
            {// Promise available
                pproc();
            }
            else
            {// No Promise
                proc();
            }

        }
        catch (err)
        {
            console.log("Error occured :" + err);
        }

    }

})();

/*
* MIT License
*
*Copyright (c) 2018 Ng Chiang Lin
*
*Permission is hereby granted, free of charge, to any person obtaining a copy
*of this software and associated documentation files (the "Software"), to deal
*in the Software without restriction, including without limitation the rights
*to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
*copies of the Software, and to permit persons to whom the Software is
*furnished to do so, subject to the following conditions:
*
*The above copyright notice and this permission notice shall be included in all
*copies or substantial portions of the Software.
*
*THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
*IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
*FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
*AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
*LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
*OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
*SOFTWARE.
*
*/

package sg.nighthour.app;

import java.io.IOException;
import java.io.PrintWriter;
import java.util.logging.Logger;
import javax.servlet.RequestDispatcher;
import javax.servlet.ServletException;
import javax.servlet.annotation.WebServlet;
import javax.servlet.http.HttpServlet;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import javax.servlet.http.HttpSession;

/**
 * Servlet implementation class ApplicationControllerServlet
 */

@WebServlet(name="ApplicationControllerServlet",
loadOnStartup = 1,
urlPatterns = {"/home",
               "/domain",
               "/action",
               "/mode",
               "/url",
               "/domainctl",
               "/modectl",
               "/urlctl",
               "/actionctl"})

public class ApplicationControllerServlet extends HttpServlet {
	private static final long serialVersionUID = 1L;
	private static final Logger log = Logger.getLogger(ApplicationControllerServlet.class.getName());
       
    /**
     * @see HttpServlet#HttpServlet()
     */
    public ApplicationControllerServlet() {
        super();
    }

	/**
	 * @see HttpServlet#doGet(HttpServletRequest request, HttpServletResponse response)
	 */
	protected void doGet(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
		
	    request.setCharacterEncoding("UTF-8");
        response.setContentType("text/plain;charset=UTF-8");
        response.setHeader("Cache-Control", "no-store");
        
	    String spath = request.getServletPath();
	    String csrf = request.getParameter("csrf");
	    String viewurl = "/WEB-INF/views"; 
	    
        HttpSession sess = request.getSession(false);
        
        if(sess == null)
        {
            log.warning("Error: Null Session : GET : " + request.getRemoteAddr());
            response.sendRedirect("/index.jsp");
            return;
        }
	    
	    if(spath.equals("/home"))
	    {
	        viewurl = viewurl +  spath + ".jsp";
	    }
	    else if(spath.equals("/domain"))
	    {
	        viewurl = viewurl +  spath + ".jsp";
	    }
	    else if(spath.equals("/action"))
	    {
	        viewurl = viewurl +  spath + ".jsp";
	    }
	    else if(spath.equals("/mode"))
	    {
	        viewurl = viewurl +  spath + ".jsp";
	    }
	    else if(spath.equals("/url"))
	    {
	        viewurl = viewurl +  spath + ".jsp";
	    }
	    else
	    {//Redirect back to index.jsp if path is not valid
	        log.warning("Error: Invalid Servlet Path: GET " + spath + " : " + request.getRemoteAddr());
	        sess.invalidate();
            response.sendRedirect("/index.jsp");
            return;   
	    }
	    
	   
	    if(sess.getAttribute("userid")== null)
	    {//Not authenticated redirect back to index.jsp
	        log.warning("Error: Unauthenticated Session : " + request.getRemoteAddr());
	        sess.invalidate();
	        response.sendRedirect("/index.jsp");
	        return;
	    }
	    else
	    {//Authenticated sessions forward to views
	        
	        sess.setAttribute("currenturl", spath);
	        String saved_csrf = (String) sess.getAttribute(spath);
	        
	        if(AntiCSRFToken.compareToken(csrf, saved_csrf))
	        {//Anti CSRF check is ok
	            sess.removeAttribute(spath);
                RequestDispatcher dp = request.getRequestDispatcher(viewurl);
                dp.forward(request, response);
                return;
	            
	        }
	        else
	        {//Invalid Anti CSRF parameters
	            String userid = (String) sess.getAttribute("userid");
                log.warning("Error: Invalid csrf : " + userid + " : " + request.getRemoteAddr());
                sess.setAttribute("userid2fa", userid);
                sess.removeAttribute("userid");
                RequestDispatcher dp = request.getRequestDispatcher("/WEB-INF/views/otp.jsp");
                dp.forward(request, response);
                return;
	        }
	       
	
	    }
	    
	    
	}

	/**
	 * @see HttpServlet#doPost(HttpServletRequest request, HttpServletResponse response)
	 */
	protected void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
		
	    request.setCharacterEncoding("UTF-8");
        response.setContentType("text/plain;charset=UTF-8");
        response.setHeader("Cache-Control", "no-store");
        
        PrintWriter out = response.getWriter();
        String spath = request.getServletPath();
        String csrf = request.getParameter("csrf");
        
        HttpSession session = request.getSession(false);
        if(session == null)
        {//no existing session
            log.warning("Error: Null Session : POST : " + spath + " : " + request.getRemoteAddr());
            response.sendRedirect("/index.jsp");
            return;
        }
        
        String userid = (String)session.getAttribute("userid");
        
        if(userid == null)
        {//Session not authenticated
            log.warning("Error: Unauthenticated Session : POST : " + spath + " : " + request.getRemoteAddr());
            session.invalidate();
            response.sendRedirect("/index.jsp");
            return;
        }
        
        String saved_csrf = (String) session.getAttribute(spath);
        
        if(spath.equals("/domainctl"))
        {
            if(AntiCSRFToken.compareToken(csrf, saved_csrf))
            {
                DomainHandler.handleRequest(request, response, userid, out);
                return; 
            }
            else
            {
                log.warning("Error: Invalid csrf : POST : " + spath + " : " +
                     userid + " : " + request.getRemoteAddr());
                out.println("Error: Invalid CSRF Token");
                return;
            }
            
        }
        else if(spath.equals("/modectl"))
        {
            
            if(AntiCSRFToken.compareToken(csrf, saved_csrf))
            {
                ModeHandler.handleRequest(request, response, userid, out);
                return; 
            }
            else
            {
                log.warning("Error: Invalid csrf : POST : " + spath + " : " +
                     userid + " : " + request.getRemoteAddr());
                out.println("Error: Invalid CSRF Token");
                return;
            }
            
        }
        else if(spath.equals("/urlctl"))
        {
           
            if(AntiCSRFToken.compareToken(csrf, saved_csrf))
            {
                UrlHandler.handleRequest(request, response, userid, out);
                return; 
            }
            else
            {
                log.warning("Error: Invalid csrf : POST : " + spath + " : " +
                     userid + " : " + request.getRemoteAddr());
                out.println("Error: Invalid CSRF Token");
                return;
            }
            
        }
        else if(spath.equals("/actionctl"))
        {
            
            if(AntiCSRFToken.compareToken(csrf, saved_csrf))
            {
                ActionHandler.handleRequest(request, response, userid, out);
                return; 
            }
            else
            {
                log.warning("Error: Invalid csrf : POST : " + spath + " : " +
                     userid + " : " + request.getRemoteAddr());
                out.println("Error: Invalid CSRF Token");
                return;
            }
            
        }
        else
        {
            
            log.warning("Error: Invalid servlet path : POST : " + spath + " : " +
                    userid + " : " + request.getRemoteAddr());
            return;
            
        }
	    
	    
	}

}

/*
* MIT License
*
*Copyright (c) 2018 Ng Chiang Lin
*
*Permission is hereby granted, free of charge, to any person obtaining a copy
*of this software and associated documentation files (the "Software"), to deal
*in the Software without restriction, including without limitation the rights
*to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
*copies of the Software, and to permit persons to whom the Software is
*furnished to do so, subject to the following conditions:
*
*The above copyright notice and this permission notice shall be included in all
*copies or substantial portions of the Software.
*
*THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
*IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
*FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
*AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
*LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
*OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
*SOFTWARE.
*
*/

package sg.nighthour.app;

import java.io.IOException;
import java.io.PrintWriter;
import java.util.logging.Logger;
import javax.servlet.ServletException;
import javax.servlet.annotation.WebServlet;
import javax.servlet.http.HttpServlet;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;


/**
 * Servlet implementation class WebRptServlet
 */
@WebServlet("/webrpt")
public class WebRptServlet extends HttpServlet
{
    private static final long serialVersionUID = 1L;

    private static final Logger log = Logger.getLogger(WebRptServlet.class.getName());

    /**
     * @see HttpServlet#HttpServlet()
     */
    public WebRptServlet()
    {
        super();
    }

    /**
     * @see HttpServlet#doPost(HttpServletRequest request, HttpServletResponse
     *      response)
     */
    protected void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException
    {

        request.setCharacterEncoding("UTF-8");
        response.setContentType("text/plain;charset=UTF-8");
        response.setCharacterEncoding("utf-8");

        // Check that request comes from a valid origin
        String origin = request.getHeader("Origin");
        if (origin == null)
        {
            log.warning("Error: Origin header not present : " + request.getRemoteAddr());
            return;
        }

        String domainentry = WebRptHandler.extractDomain(origin);
        if (domainentry == null)
        {
            log.warning("Error: Cannot extract domain from origin header : " + 
              origin + " : " + request.getRemoteAddr());
            return;
        }

        // Make sure that it is a valid domain under monitoring by the application
        if (!WebRptHandler.isValidDomain(domainentry))
        {
            log.warning("Error: Domain is not present in application datastore : " + 
                    domainentry + " : " + request.getRemoteAddr());
            return;
        }

        
        PrintWriter out = response.getWriter();
        response.setHeader("Cache-Control", "no-store");
        response.setHeader("Access-Control-Allow-Origin", origin);

        WebRptHandler.handleRequest(request, response, null, out);

    }

    /**
     * @see HttpServlet#doOptions(HttpServletRequest, HttpServletResponse)
     */
    protected void doOptions(HttpServletRequest request, HttpServletResponse response)
            throws ServletException, IOException
    {

        request.setCharacterEncoding("UTF-8");
        response.setContentType("text/plain;charset=UTF-8");

        // Check that request comes from a valid origin
        String origin = request.getHeader("Origin");
        if (origin == null)
        {
            log.warning("Error: Origin header not present : " + request.getRemoteAddr());
            return;
        }

        String domain = WebRptHandler.extractDomain(origin);
        if (domain == null)
        {
            log.warning("Error: Cannot extract domain from origin header : " + 
              origin + " : " + request.getRemoteAddr());
            return;
        }
        
        if (!WebRptDAO.isValidDomain(domain))
        {
            log.warning("Error: Domain is not present in application datastore : " + 
                    domain + " : " + request.getRemoteAddr());
            return;
        }
            
        response.setHeader("Cache-Control", "no-store");
        response.setHeader("Access-Control-Allow-Origin", origin);
        response.setHeader("Access-Control-Allow-Methods", "POST, GET, OPTIONS, DELETE, PUT");
        response.setHeader("Access-Control-Max-Age", "3600");
        response.setHeader("Access-Control-Allow-Headers", "Content-Type");

    }

}

    /**
     * Handle and process incoming webreports from clients
     * 
     * @param request
     * @param response
     * @param userid
     * @param out
     * @throws ServletException
     * @throws IOException
     */
    public static void handleRequest(HttpServletRequest request, HttpServletResponse response, String userid, PrintWriter out)
            throws ServletException, IOException
    {
        
        BufferedReader in = request.getReader();
        
        String line = null;
        StringBuffer strbuf = new StringBuffer();
        while ((line = in.readLine()) != null)
        {
            strbuf.append(line);
        }

        String jsoninput = strbuf.toString();
        // Obtain WebReport object from the Json input
        WebReport wreport = processJson(jsoninput, request.getRemoteAddr());
        
        if(wreport == null)
        {
            log.warning("Error: Cannot parse json : " + jsoninput + " : " + request.getRemoteAddr());
            return;
        }

       
        String domain = extractDomain(wreport.getURL());
        if (domain != null)
        {
            wreport.setDomain(domain);
        }
        else
        {
            log.warning("Error: Cannot extract domain from JSON webreport : " + 
                wreport.getURL() + " : " + request.getRemoteAddr());
            return;
        }
        
        String origin = request.getHeader("Origin");
        origin = extractDomain(origin); 
        if(origin == null)
        {
            log.warning("Error: Cannot extract domain from origin header : " + 
                    request.getHeader("Origin") + " : " + request.getRemoteAddr());
             return;
        }
        
        //Check to make sure that domain in the origin header is the same
        //as the domain in the webreport
        if(!domain.equals(origin))
        {
            log.warning("Error: Origin domain does not match report domain : " + 
                    origin + " : " + domain + " : " + request.getRemoteAddr());
            return; 
        }

        userid = WebRptDAO.getUserIdFromDomain(domain);
        if (userid == null)
        {
            log.warning("Error: Cannot extract user from domain in JSON webreport : " + 
                    domain + " : " + request.getRemoteAddr());
           return;
        }

        String mode = WebRptDAO.getModeFromUserid(userid);
        String allowip = WebRptDAO.getAllowCaptureIP(userid);
        
        if(mode == null || allowip == null)
        {
            log.warning("Error: " + " null mode or null capture ip " + userid 
                    + request.getRemoteAddr());
            return; 
        }

       
        if (mode.equals(AppConstants.MODEMONITOR))
        {// monitor mode
             
             String checksum = WebRptDAO.getURLChecksum(userid, domain, wreport.getURL());
  
             String useragent = request.getHeader("User-Agent");
             if(useragent == null)
             {
                 useragent = "unknown"; 
             }
             
             if(checksum == null)
             {//url not found or error getting checksum behave as if monitoring is disabled
                 log.warning("Error: Monitor mode url is not found or error : "  + userid + " : " +  domain +
                         " : " + wreport.getURL() + " : " + request.getRemoteAddr());
                 return;
             }
             
             if(checksum.equals(wreport.getCheckSum()))
             {//sha256 hash matches
                 out.println("Ok");
                 return;
             }
             else if( WebRptDAO.isRedirectionEnabled(userid))
             {// sha256 hash does not match alert and redirect to error page
                 
                 String redirecturl = WebRptDAO.getRedirectionURL(userid);
                 
                 if(redirecturl != null)
                 {
                     out.println("600 " + redirecturl); 
                 }
                 else
                 {
                     log.warning("Error: Monitor mode cannot get redirection url : "  + userid + " : " +  domain +
                             " : " + wreport.getURL() + " : " + request.getRemoteAddr());
                 }
                 
             
                 
                 String alertkey = WebRptDAO.createAlert(wreport, userid, request.getRemoteAddr(),useragent);
                 Queue queue = QueueFactory.getQueue("alert-queue");
                 queue.add(TaskOptions.Builder.withUrl("/worker").param("key", alertkey));
                 
                 return; 
             }
             else 
             {//sha256 hash does not match redirection is not enabled
                 String alertkey = WebRptDAO.createAlert(wreport, userid, request.getRemoteAddr(),useragent);
                 Queue queue = QueueFactory.getQueue("alert-queue");
                 queue.add(TaskOptions.Builder.withUrl("/worker").param("key", alertkey));
                 return; 
             }
             

          }
          else if (mode.equals(AppConstants.MODECAPTURE) && allowip.equals(request.getRemoteAddr()))
          {// capture mode
               WebRptDAO.createURL(wreport, domain, userid, request.getRemoteAddr());
               return; 
          }
          else
          {// disable mode
               return;
          }
            
        
    }

/*
* MIT License
*
*Copyright (c) 2018 Ng Chiang Lin
*
*Permission is hereby granted, free of charge, to any person obtaining a copy
*of this software and associated documentation files (the "Software"), to deal
*in the Software without restriction, including without limitation the rights
*to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
*copies of the Software, and to permit persons to whom the Software is
*furnished to do so, subject to the following conditions:
*
*The above copyright notice and this permission notice shall be included in all
*copies or substantial portions of the Software.
*
*THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
*IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
*FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
*AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
*LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
*OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
*SOFTWARE.
*
*/

package sg.nighthour.app;

import java.io.IOException;
import java.io.PrintWriter;
import java.util.logging.Logger;

import javax.servlet.ServletException;
import javax.servlet.annotation.WebServlet;
import javax.servlet.http.HttpServlet;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

import com.google.appengine.api.datastore.DatastoreService;
import com.google.appengine.api.datastore.DatastoreServiceFactory;
import com.google.appengine.api.datastore.Key;
import com.google.appengine.api.datastore.KeyFactory;

import com.google.appengine.api.datastore.EntityNotFoundException;
import com.google.appengine.api.datastore.Entity;
import com.google.appengine.api.datastore.Text;

import java.util.ArrayList;
import java.util.Collections;
import java.util.Hashtable;
import java.util.Properties;

import javax.naming.Context;
import javax.naming.NamingEnumeration;
import javax.naming.NamingException;
import javax.naming.directory.Attribute;
import javax.naming.directory.Attributes;
import javax.naming.directory.DirContext;
import javax.naming.directory.InitialDirContext;

import javax.mail.Message;
import javax.mail.MessagingException;
import javax.mail.Session;
import javax.mail.Transport;
import javax.mail.internet.InternetAddress;
import javax.mail.internet.MimeMessage;

/**
 * Servlet implementation class TaskWorkerServlet
 */
@WebServlet("/worker")
public class TaskWorkerServlet extends HttpServlet
{
    private static final long serialVersionUID = 1L;
    private static final Logger log = Logger.getLogger(TaskWorkerServlet.class.getName());

    /**
     * @see HttpServlet#HttpServlet()
     */
    public TaskWorkerServlet()
    {
        super();

    }

    /**
     * @see HttpServlet#doPost(HttpServletRequest request, HttpServletResponse
     *      response)
     */
    protected void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException
    {
        request.setCharacterEncoding("UTF-8");
        PrintWriter out = response.getWriter();
        response.setContentType("text/plain;charset=UTF-8");

        // Retrieve the Alert entity key
        String key = request.getParameter("key");
        // log.warning("Got : " + key);
        if(key == null)
        {
            log.warning("Error: Alert key is null : " + request.getRemoteAddr());
            response.setStatus(400);
            return;
        }
        
        
        long numerickey = Long.parseLong(key);
        

        DatastoreService datastore = DatastoreServiceFactory.getDatastoreService();

        Key k1 = KeyFactory.createKey("Alert", numerickey);

        String userid = null;
        String content = null;
        String senderip = null;
        String sha256 = null;
        String url = null;
        String useragent = null; 

        try
        { // Retrieve the alert entity
            Entity alert = datastore.get(k1);
            userid = (String) alert.getProperty("userid");
            content = ((Text) alert.getProperty("content")).getValue();
            senderip = (String) alert.getProperty("senderip");
            sha256 = (String) alert.getProperty("sha256");
            url = (String) alert.getProperty("url");
            useragent = (String)alert.getProperty("useragent"); 
        }
        catch (EntityNotFoundException e)
        {
            log.warning("Unable to retrieve alert entity : " + key);
            throw new ServletException("Unable to retrieve alert entity");
        }

        // Get the email domain
        String arr[] = userid.split("@");
        if (arr.length != 2)
        {
            log.warning("Invalid email domain");
            throw new ServletException("Invalid email domain");
        }
        String emaildomain = arr[1];

        // Look up MX records for email domain
        ArrayList<String> mxrecords = new ArrayList<String>();
        Hashtable<String, Object> env = new Hashtable<String, Object>();
        env.put(Context.INITIAL_CONTEXT_FACTORY, "com.sun.jndi.dns.DnsContextFactory");
        env.put(Context.PROVIDER_URL, "dns://8.8.8.8 dns://8.8.4.4");

        try
        {
            DirContext ctx = new InitialDirContext(env);
            Attributes attrs = ctx.getAttributes(emaildomain, new String[] { "MX" });

            NamingEnumeration<?> results = attrs.getAll();
            while (results.hasMore())
            {
                Attribute attr = (Attribute) results.next();
                NamingEnumeration<?> mxresults = attr.getAll();
                while (mxresults.hasMore())
                {
                    String mx = (String) mxresults.next();
                    mxrecords.add(mx);
                }
            }

        }
        catch (NamingException e)
        {
            log.warning("NamingException unable to get MX : " + e);
            throw new ServletException("NamingException unable to get MX : " + e);
        }

        Collections.sort(mxrecords);
        if (mxrecords.isEmpty())
        {
            log.warning("Empty MX records");
            throw new ServletException("Empty MX records");
        }

        // Send email alert
        boolean done = false;
        int index = 0;

        while (!done && (index < mxrecords.size()))
        {

            String smtphost = mxrecords.get(index);
            try
            {
                Properties props = new Properties();
                props.put("mail.smtp.auth", "false");
                props.put("mail.smtp.starttls.enable", "true");
                // props.put("mail.smtp.localhost", "nighthour.sg");
                props.put("mail.smtp.host", smtphost);
                props.put("mail.smtp.port", "25");
                Session session = Session.getInstance(props);
                String msg = "Web Content has changed \n" + url + "\n" 
                        + "Sender Address : " + senderip + "\n"
                        + "Sha256 : " + sha256 + "\n" 
                        + "User Agent: " + useragent + "\n"
                        + "Note: The content below doesn't include external resources such as images, css, javascript files." 
                        + "\n\n" + content;

                MimeMessage message = new MimeMessage(session);
                message.setFrom(new InternetAddress(AppConstants.fromemail));
                message.setRecipients(Message.RecipientType.TO, InternetAddress.parse(userid));
                message.setSubject("Alert message " + url);
                message.setText(msg, "UTF-8");
                Transport.send(message);
                done = true;
                // delete the alert entity
                datastore.delete(k1);
            }
            catch (MessagingException e)
            {
                log.warning("Error sending email " + index + " " + smtphost);
                if (index == (mxrecords.size() - 1))
                {
                    throw new ServletException("Error sending email");
                }
            }

            index++;
        }

        
        out.println("");

    }

}

<!DOCTYPE html>

<html>
<head>
<meta charset="UTF-8">
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<title>Test Monitor </title>
</head>
<body>

<h2>Hello Testing Web Monitor</h2>
<p>
This is a test page for client side web content monitoring.
</p>

</body>
</html>